CVE-2023-3417 File Extension Spoofing using the Text Direction Override Character

Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This...

CVE-2023-3417

CVE-2023-3417 affects Mozilla Thunderbird. The issue arises from the Text Direction Override Unicode Character in filenames, which could cause an email attachment to appear as a non-executable document when it was actually an executable. Affected: Thunderbird versions before 115.0.1 and before 10...

CVE-2023-3417

Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This...

The vulnerability in the Thunderbird email client exists due to incorrect processing of Unicode characters for determining the text direction in file names. This allows attackers to perform spoofing attacks.

The vulnerability of the Thunderbird email client exists due to the incorrect processing of the Unicode character, which affects the direction of text in file names. Exploiting this vulnerability allows a remote attacker to perform spam attacks...

Mozilla Thunderbird 安全漏洞

Mozilla Thunderbird is the United States Mozilla Foundation's set of independent from the Mozilla Application Suite e-mail client software. The program supports IMAP and POP mail protocols as well as the HTML mail format. A security vulnerability exists in Mozilla Thunderbird versions prior to...

WordPress Art Direction Plugin <= 0.2.4 is vulnerable to Cross Site Scripting (XSS)

Software Art Direction Type Plugin Vulnerable versions = 0.2.4 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-37983 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 4089f50ae9ad Credits Yuki Haruma Required...

PT-2025-49491

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.3.0-syzkaller-12049-g58390c8ce1bd Description The Linux kernel usbtmc driver had a flaw where it did not check the direction of 0-length ioctl control messages. This could lead to issues when a user submits an...

PT-2025-54102

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel related to a reference leak within the xfrm subsystem. Specifically, the issue occurs during direction checks where the netdev reference tracker is...

Denial Of Service (DoS)

u-boot is vulnerable to Denial Of Service DoS. The vulnerability exists because the U-Boot DFU implementation does not bind the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command, allowing an attacker to write...

GSD-2023-1002414 net: USB: Fix wrong-direction WARNING in plusb.c

net: USB: Fix wrong-direction WARNING in plusb.c This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.273 by commit...

GSD-2023-1002404 net: USB: Fix wrong-direction WARNING in plusb.c

net: USB: Fix wrong-direction WARNING in plusb.c This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.232 by commit...

GSD-2023-1002387 net: USB: Fix wrong-direction WARNING in plusb.c

net: USB: Fix wrong-direction WARNING in plusb.c This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.168 by commit...

SUSE CVE-2007-1216

Double free vulnerability in the GSS-API library lib/gssapi/krb5/k5unseal.c, as used by the Kerberos administration daemon kadmind in MIT krb5 before 1.6.1, when used with the authentication method provided by the RPCSECGSS RPC library, allows remote authenticated users to execute arbitrary code...

SUSE CVE-2010-0049

Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service application crash via HTML elements with right-to-left RTL text directionality...

SUSE CVE-2019-6461

An issue was discovered in cairo 1.16.0. There is an assertion problem in the function cairoarcindirection in the file cairo-arc.c...

PT-2024-14697

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a kernel warning that occurs when sending a SYN message. The warning is caused by a lack of copy direction from the iterator viewpoint, which leads to a kernel...

Hackers Targeting U.S. and German Firms Monitor Victims' Desktops with Screenshotter

A previously unknown threat actor has been targeting companies in the U.S. and Germany with bespoke malware designed to steal confidential information. Enterprise security company Proofpoint, which is tracking the activity cluster under the name Screentime, said the group, dubbed TA866, is likely...

kernel: crypto: qat - fix DMA transfer direction

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix DMA transfer direction When CONFIGDMAAPIDEBUG is selected, while running the crypto self test on the QAT crypto algorithms, the function adddmaentry reports a warning similar to the one below, saying that...

Over 4,500 WordPress Sites Hacked to Redirect Visitors to Sketchy Ad Pages

A massive campaign has infected over 4,500 WordPress websites as part of a long-running operation that's been believed to be active since at least 2017. According to GoDaddy-owned Sucuri, the infections involve the injection of obfuscated JavaScript hosted on a malicious domain named...

Raccoon and Vidar Stealers Spreading via Massive Network of Fake Cracked Software

A "large and resilient infrastructure" comprising over 250 domains is being used to distribute information-stealing malware such as Raccoon and Vidar since early 2020. The infection chain "uses about a hundred of fake cracked software catalogue websites that redirect to several links before...